UBUNTU-CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

EUVD-2026-85786

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-92530

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to spoof merge request authorship and attribute content to arbitrary existing users on t...

CVE-2026-96763

The kvcache-ai mooncake software (versions up to 0.3.12 , 0.3.13.post1 , and 0.3.14-rc1 ) contains a security flaw in the MountSegment Request Processing component. Specifically, the ScopedSegmentAccess::MountSegment function within the segment.cpp file is susceptible to improper access controls ...

CVE-2026-96763 kvcache-ai mooncake MountSegment Request Processing segment.cpp access control

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access control...

CVE-2026-96763 kvcache-ai mooncake MountSegment Request Processing segment.cpp access control

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access control...

EUVD-2026-85752

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access control...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149: Incomplete List of Disallowed Inputs

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

Linux Distros Unpatched Vulnerability : CVE-2026-66070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed...

CVE-2026-96763: Improper Access Control

A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access control...

PT-2026-98459

Name of the Vulnerable Software and Affected Versions OpenStack Swift affected versions not specified Description An issue exists in the s3api middleware where truncated aws-chunked PUT request bodies are handled incorrectly. An authenticated attacker can exploit this behavior to cause the system...

CVE-2026-93272: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcomwcnss: Fix handling the lack of PD regulators in v3 The changes introduced to handle single power domain platforms have swapped the info pointer increment from numpdvregs to numpds, which would shift the info...

PT-2026-98189

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.0.0 Description The LoginRadius backend fails to validate the OAuth state during the authentication flow. This leads to a login Cross-Site Request Forgery CSRF, where an attacker can force a victim's...

PT-2026-98234

A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowledgeDocumentServiceImpl.java of the component AI Knowledge Module. This manipulation of the argument url causes server-side...

PT-2026-98127

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the thunderbolt component where the tb-root switch is not properly set to NULL when a domain is stopped. This failure to clear the root switch prevents the tb xdp hand...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124475)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124475 advisory. When using http.CrossOriginProtection, the AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. CrossOriginProtection then skips...

CVE-2026-85491: Incomplete Comparison with Missing Factors

Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a dispatch memo keyed on the request path alone. Catalyst::Seal replaces the dispatcher's prepareaction with a version that memoises how a path resolved: which...